Skip to content

A Security Analysis of the OpenClaw AI Agent Framework

🕒 Published (v1): 2026-03-29 04:51 UTC · Source: Arxiv · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

This paper presents a systematic two-axis security taxonomy built from 470 CVE-grade advisories against OpenClaw, an open-source AI agent framework that wires LLM reasoning to shell, filesystem, containers, browser automation, and messaging platforms. Three principal findings emerge: a multi-advisory unauthenticated RCE kill chain, a family of exec-allowlist bypasses rooted in a closed-world lexical-parsing assumption, and a skill-distribution supply-chain attack that executes a two-stage dropper entirely inside the LLM context window, above every runtime policy primitive. The dominant architectural root cause across all categories is per-layer, per-call-site trust enforcement rather than unified policy boundaries.

Problem

Prior AI-agent security work characterizes individual attack techniques (prompt injection, indirect injection, model extraction) in isolation, without a unifying model that maps adversarial techniques to the specific architectural layer they exploit. A corpus as large and structurally varied as 470 advisories against a single framework cannot be understood as a flat list; its implications emerge from cross-layer relationships. The paper fills this gap with a structured taxonomy that is simultaneously a retrospective audit and a forward-looking threat model.

Method

The authors organize 470 OpenClaw security advisories (filed January 31–April 15, 2026) along two independent axes:

System axis — ten architectural layers: Channel Input Interface, Plugin & Skill Distribution, Agent Context Window, Gateway WebSocket Interface, Tool Dispatch Interface, Exec Policy Engine, Container Boundary, Host OS Interface, LLM Provider Interface, Inter-Agent Communication.

Attack axis — six kill-chain stages adapted from MITRE ATT&CK, with one novel stage added: Context Manipulation (adversary corrupts the LLM's reasoning context to induce attacker-intended tool calls without any code execution or policy bypass at the runtime layer).

Each advisory is classified by both axes, producing a 10×6 taxonomy matrix. Three case studies are developed with patch-differential evidence: (1) mapping advisories GHSA-[6,7] through Gateway and Node-Host into a complete unauthenticated RCE chain; (2) enumerating exec-allowlist bypass families (line continuation, busybox multiplexing, GNU long-option abbreviation, env-var injection); and (3) tracing a malicious skill dropper that operates entirely within the LLM context window, bypassing the exec pipeline.

Key Contributions

  • Two-axis security taxonomy (system axis × kill-chain axis) applicable to any personal AI agent framework, instantiated on the full 470-advisory OpenClaw corpus.
  • OpenClaw-specific kill chain extending MITRE ATT&CK with the novel Context Manipulation stage — an attack stage with no analog in traditional intrusion frameworks, present in any system that interposes an LLM reasoning layer between input and execution.
  • Multi-layer vulnerability analysis identifying systemic root causes: (a) mutable identity fields used as security-policy keys across 15 channel adapters, (b) closed-world lexical parsing in the Exec Policy Engine, (c) operator-level trust granted to skill instruction files loaded into the LLM context.
  • Empirical confirmation that the Plugin & Skill Distribution surface can deliver a complete attack chain (two-stage dropper) while remaining entirely invisible to runtime exec-policy enforcement.

Results

  • Total corpus: 470 advisories across three disclosure waves (Jan 31 – Apr 15, 2026).
  • Gateway WebSocket Interface: 121 advisories (25.7%), 7 Critical + 47 High — highest-risk single surface.
  • Channel Input Interface: 119 advisories (25.3%) across 15 platform adapters; dominant root cause is mutable sender-identity fields used as allowlist keys.
  • Exec Policy Engine: 77 advisories (16.4%); all rooted in the single assumption that command identity is recoverable by lexical parsing.
  • Tool Dispatch Interface: 69 advisories (14.7%).
  • Container Boundary: 39 advisories including 2 Critical, 14 High; sandbox isolation not enforced by framework itself.
  • Plugin & Skill Distribution: 28 advisories (6.0%); all supply-chain findings concentrated here.
  • Three previously theoretical surfaces acquired empirical coverage by April 2026: Host OS Interface (3), LLM Provider Interface (2), Inter-Agent Communication (1).
  • Gateway + Channel surfaces together account for >50% of the corpus; Exec Policy Engine dropped from 1st to 3rd between February and April snapshots as gateway/channel advisory volume accelerated.

Limitations

  • Analysis is specific to one framework (OpenClaw); generalizability to other agent runtimes (LangChain, AutoGen, etc.) is asserted but not empirically validated.
  • Severity ratings are drawn from filed advisories, not independently re-scored; inter-rater reliability of the taxonomy classification is not reported.
  • The paper is truncated in the provided text — defense strategies (Section 6) and conclusions (Section 7) are not available for evaluation.
  • The corpus captures advisories, not confirmed exploits; exploitability in realistic deployments is not measured.
  • Inter-Agent Communication is the surface with fewest advisories (1) despite being assessed as spanning all six kill-chain stages — the threat model assertion outpaces empirical data.

Relevance to Harnesses / Meta-Harnesses

OpenClaw is structurally a representative meta-harness: it orchestrates LLM reasoning across tool-dispatch, plugin loading, sandboxed execution, and external messaging surfaces — the same design pattern used in paper-digest harnesses that chain fetch → summarize → write → publish steps via LLM tool calls. The paper's central finding — that per-layer trust enforcement (rather than a unified policy boundary) is the systemic root cause of cross-layer exploit chains — applies directly to any harness that composes multiple execution surfaces under a single LLM reasoning loop. The novel Context Manipulation kill-chain stage is especially relevant: a harness that ingests untrusted external content (arxiv abstracts, HuggingFace READMEs, web-fetched HTML) and routes that content into the agent's context window before tool dispatch is exposed to this stage without any exec-policy mitigation available. The skill/plugin supply-chain vector (CLAUDE.md and skill instruction files loaded at operator-level trust) maps directly to how meta-harnesses configure agent behavior through injected system prompts and fetched configuration files.